Liquid Network sees ~4,000 BTC peg-out

Liquid Network said on September 6 that about 4,000 BTC, worth roughly $320 million at current prices, was withdrawn from its federation wallet in what it described as a security incident. The Bitcoin sidechain said purported white-hat hackers carried out the withdrawal and that Blockstream, the network’s technology provider, was trying to contact them with an on-chain signed message. (status.blockstream.com) Blockstream’s status page said bridge nodes were disabled and no new transactions could be submitted, effectively pausing the Liquid sidechain. Exchanges were told to pause LBTC deposits and withdrawals. ### How did Liquid describe what happened? Blockstream’s status page said the funds were withdrawn “via the SideSwap PAK (Peg-out Authorization Key),” while adding that the key “was not compromised, nor were any others.” Liquid did not identify the parties behind the move or say whether the bitcoin would be returned. (status.blockstream.com) The Block reported on September 6 that the withdrawal represented roughly 95% of Liquid’s reported bitcoin reserves, which stood at about 4,200 BTC before the incident. That figure was cited in the outlet’s account of Liquid’s public statements. (status.blockstream.com) ### What is a peg-out on Liquid, and why does that matter here? Blockstream’s help documentation says a peg-out is the process that moves bitcoin from the Liquid sidechain back to the Bitcoin mainchain by burning LBTC and releasing an equal amount of BTC from the federation’s multisig wallet. The same documentation says only Liquid Federation members can perform peg-outs directly. (status.blockstream.com) Blockstream’s documentation also says Liquid’s functionaries process peg-outs and secure the two-way peg. The network currently has 15 functionaries, and 11 of 15 signatures are required to validate blocks; peg-out transactions are also validated and signed by keys held in the functionaries’ hardware security modules, or HSMs. (theblock.co) ### What is SideSwap’s role in the process? Liquid’s public incident update named SideSwap’s PAK, short for Peg-out Authorization Key, as the route used in the withdrawal. The Block, citing Liquid, said the funds were withdrawn through the SideSwap PAK. (help.blockstream.com) Blockstream’s help page says the HSM will sign peg-out transactions only if outputs go back to the federation or to a whitelisted address. That means a PAK-based withdrawal is part of Liquid’s normal peg-out plumbing, even though the September 6 transaction is being treated as a security incident. That description is based on Blockstream’s published explanation of how Liquid functionaries and peg-outs work. (help.blockstream.com) ### What has been halted, and what has not? Blockstream’s incident page said public bridge nodes were the affected component and that no new transactions could be submitted while the issue was being resolved. The company said Liquid wallets would be impacted during the pause. (status.blockstream.com) The same update said other Liquid assets, including USDT, DePix and real-world assets, were unaffected by the security incident. The pause applied to the sidechain’s transaction flow and to LBTC deposits and withdrawals at exchanges that were notified by the network. ### What should users watch next? (help.blockstream.com) September 7 is the date of Blockstream’s latest public status update, and that page said federation members were actively working to resolve the issue and restore normal network activity. The company has not yet published a technical post-mortem or a timeline for reopening bridge nodes. (status.blockstream.com) Blockstream said its next steps were contacting the parties behind the withdrawal on-chain, tracing the funds and coordinating with exchanges that paused LBTC transfers. Any restart of Liquid activity is expected to appear first on the company’s status page and in follow-up statements from Liquid or Blockstream. (status.blockstream.com)